Hello, Please help to catch this patch into edk2 202005 stable tag. Thank you
-----Original Message----- From: devel@edk2.groups.io <devel@edk2.groups.io> On Behalf Of Maggie Chu Sent: Monday, May 18, 2020 7:42 PM To: devel@edk2.groups.io Cc: Dong, Eric <eric.d...@intel.com>; Wang, Jian J <jian.j.w...@intel.com>; Zhang, Chao B <chao.b.zh...@intel.com>; Yao, Jiewen <jiewen....@intel.com> Subject: [edk2-devel] [PATCH v3] SecurityPkg: Change default value source https://bugzilla.tianocore.org/show_bug.cgi?id=2713 In current code, If TCG2_PHYSICAL_PRESENCE_FLAGS_VARIABLE variable is not exist, code will get default value from two places. This fix is to make the default value comes from the PCD gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags Signed-off-by: Maggie Chu <maggie....@intel.com> Cc: Eric Dong <eric.d...@intel.com> Cc: Jian J Wang <jian.j.w...@intel.com> Cc: Chao Zhang <chao.b.zh...@intel.com> Cc: Jiewen Yao <jiewen....@intel.com> --- v3 change: Remove TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT and TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT. Extend year of copyright. SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h | 17 +---------------- .../DxeTcg2PhysicalPresenceLib.c | 6 +++--- .../PeiTcg2PhysicalPresenceLib.c | 4 ++-- .../PeiTcg2PhysicalPresenceLib.inf | 5 ++++- .../SmmTcg2PhysicalPresenceLib.c | 7 +++++-- .../SmmTcg2PhysicalPresenceLib.inf | 3 ++- SecurityPkg/SecurityPkg.dec | 15 +++++++++++++-- 7 files changed, 30 insertions(+), 27 deletions(-) diff --git a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h index 39febcb655..e5ff3b1e5e 100644 --- a/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h +++ b/SecurityPkg/Include/Library/Tcg2PhysicalPresenceLib.h @@ -2,7 +2,7 @@ This library is intended to be used by BDS modules. This library will execute TPM2 request. -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> SPDX-License-Identifier: BSD-2-Clause-Patent **/@@ -39,21 +39,6 @@ SPDX-License-Identifier: BSD-2-Clause-Patent #define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID BIT17 #define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID BIT18 -//-// Default value-//-#define TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT (TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF | \- TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR | \- TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS | \- TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS)--//-// Default value-//-#define TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT (TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID | \- TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID |\- TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID)- /** Check and execute the pending TPM request. diff --git a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c index 80e2e37bf4..1e00476509 100644 --- a/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPresenceLib.c +++ b/SecurityPkg/Library/DxeTcg2PhysicalPresenceLib/DxeTcg2PhysicalPres +++ enceLib.c @@ -7,7 +7,7 @@ Tpm2ExecutePendingTpmRequest() will receive untrusted input and do validation. -Copyright (c) 2013 - 2018, Intel Corporation. All rights reserved.<BR>+Copyright (c) 2013 - 2020, Intel Corporation. All rights reserved.<BR> SPDX-License-Identifier: BSD-2-Clause-Patent **/@@ -1194,7 +1194,7 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction ( &Flags ); if (EFI_ERROR (Status)) {- Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;+ Flags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags); } return Tcg2PpVendorLibSubmitRequestToPreOSFunction (OperationRequest, Flags.PPFlags, RequestParameter); }@@ -1228,7 +1228,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags ( &PpiFlags ); if (EFI_ERROR (Status)) {- PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;+ PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags); } return PpiFlags.PPFlags; }diff --git a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c index a111351516..b80129bf7f 100644 --- a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.c +++ b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPres +++ enceLib.c @@ -3,7 +3,7 @@ This library will get TPM 2.0 physical presence information. -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> SPDX-License-Identifier: BSD-2-Clause-Patent **/@@ -47,7 +47,7 @@ Tcg2PhysicalPresenceLibGetManagementFlags ( &PpiFlags ); if (EFI_ERROR (Status)) {- PpiFlags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;+ PpiFlags.PPFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags); } return PpiFlags.PPFlags; }diff --git a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf index d34f232022..6090927b55 100644 --- a/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPresenceLib.inf +++ b/SecurityPkg/Library/PeiTcg2PhysicalPresenceLib/PeiTcg2PhysicalPres +++ enceLib.inf @@ -3,7 +3,7 @@ # # This library will get TPM 2.0 physical presence information. #-# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> # SPDX-License-Identifier: BSD-2-Clause-Patent # ##@@ -43,5 +43,8 @@ [Ppis] gEfiPeiReadOnlyVariable2PpiGuid ## CONSUMES +[Pcd]+ gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags ## SOMETIMES_CONSUMES+ [Depex] gEfiPeiReadOnlyVariable2PpiGuiddiff --git a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c index 3827df9663..1c46d5e69d 100644 --- a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.c +++ b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPres +++ enceLib.c @@ -10,7 +10,7 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunction() and Tcg2PhysicalPresenceLibGetUserConfirmationStatusFunction() will receive untrusted input and do validation. -Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> SPDX-License-Identifier: BSD-2-Clause-Patent **/@@ -31,6 +31,7 @@ SPDX-License-Identifier: BSD-2-Clause-Patent EFI_SMM_VARIABLE_PROTOCOL *mTcg2PpSmmVariable; BOOLEAN mIsTcg2PPVerLowerThan_1_3 = FALSE;+UINT32 mTcg2PhysicalPresenceFlags; /** The handler for TPM physical presence function:@@ -162,7 +163,7 @@ Tcg2PhysicalPresenceLibSubmitRequestToPreOSFunctionEx ( &Flags ); if (EFI_ERROR (Status)) {- Flags.PPFlags = TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT;+ Flags.PPFlags = mTcg2PhysicalPresenceFlags; } ReturnCode = Tcg2PpVendorLibSubmitRequestToPreOSFunction (*OperationRequest, Flags.PPFlags, *RequestParameter); }@@ -396,5 +397,7 @@ Tcg2PhysicalPresenceLibConstructor ( Status = gSmst->SmmLocateProtocol (&gEfiSmmVariableProtocolGuid, NULL, (VOID**)&mTcg2PpSmmVariable); ASSERT_EFI_ERROR (Status); + mTcg2PhysicalPresenceFlags = PcdGet32(PcdTcg2PhysicalPresenceFlags);+ return EFI_SUCCESS; }diff --git a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf index e0e5fef5f1..6a9bdf66f0 100644 --- a/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPresenceLib.inf +++ b/SecurityPkg/Library/SmmTcg2PhysicalPresenceLib/SmmTcg2PhysicalPres +++ enceLib.inf @@ -7,7 +7,7 @@ # This driver will have external input - variable. # This external input must be validated carefully to avoid security issue. #-# Copyright (c) 2015 - 2018, Intel Corporation. All rights reserved.<BR>+# Copyright (c) 2015 - 2020, Intel Corporation. All rights reserved.<BR> # SPDX-License-Identifier: BSD-2-Clause-Patent # ##@@ -50,6 +50,7 @@ [Pcd] gEfiSecurityPkgTokenSpaceGuid.PcdTcgPhysicalPresenceInterfaceVer ## CONSUMES+ gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags ## SOMETIMES_CONSUMES [Depex] gEfiSmmVariableProtocolGuiddiff --git a/SecurityPkg/SecurityPkg.dec b/SecurityPkg/SecurityPkg.dec index 87b1fbad80..79d46308ad 100644 --- a/SecurityPkg/SecurityPkg.dec +++ b/SecurityPkg/SecurityPkg.dec @@ -5,7 +5,7 @@ # It also provides the definitions(including PPIs/PROTOCOLs/GUIDs and library classes) # and libraries instances, which are used for those features. #-# Copyright (c) 2009 - 2019, Intel Corporation. All rights reserved.<BR>+# Copyright (c) 2009 - 2020, Intel Corporation. All rights reserved.<BR> # (C) Copyright 2015 Hewlett Packard Enterprise Development LP <BR> # Copyright (c) Microsoft Corporation.<BR> # SPDX-License-Identifier: BSD-2-Clause-Patent@@ -435,7 +435,18 @@ ## This PCD defines initial setting of TCG2 Persistent Firmware Management Flags # PCD can be configured for different settings in different scenarios- # Default setting is TCG2_BIOS_TPM_MANAGEMENT_FLAG_DEFAULT | TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_DEFAULT+ # This PCD follows UEFI TCG2 library definition bit of the BIOS TPM/Storage Management Flags<BR>+ # BIT0 - Reserved <BR>+ # BIT1 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CLEAR <BR>+ # BIT2 - Reserved <BR>+ # BIT3 - TCG2_LIB_PP_FLAG_RESET_TRACK <BR>+ # BIT4 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_ON <BR>+ # BIT5 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_TURN_OFF <BR>+ # BIT6 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_EPS <BR>+ # BIT7 - TCG2_BIOS_TPM_MANAGEMENT_FLAG_PP_REQUIRED_FOR_CHANGE_PCRS <BR>+ # BIT16 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_ENABLE_BLOCK_SID <BR>+ # BIT17 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_PP_REQUIRED_FOR_DISABLE_BLOCK_SID <BR>+ # BIT18 - TCG2_BIOS_STORAGE_MANAGEMENT_FLAG_ENABLE_BLOCK_SID <BR> # @Prompt Initial setting of TCG2 Persistent Firmware Management Flags gEfiSecurityPkgTokenSpaceGuid.PcdTcg2PhysicalPresenceFlags|0x700E2|UINT32|0x0001001B -- 2.16.2.windows.1 -=-=-=-=-=-= Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59735): https://edk2.groups.io/g/devel/message/59735 Mute This Topic: https://groups.io/mt/74289131/1807365 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [maggie....@intel.com] -=-=-=-=-=-= -=-=-=-=-=-=-=-=-=-=-=- Groups.io Links: You receive all messages sent to this group. View/Reply Online (#59778): https://edk2.groups.io/g/devel/message/59778 Mute This Topic: https://groups.io/mt/74289131/21656 Group Owner: devel+ow...@edk2.groups.io Unsubscribe: https://edk2.groups.io/g/devel/unsub [arch...@mail-archive.com] -=-=-=-=-=-=-=-=-=-=-=-
